Cortex Xdr Partial protected (7.4)

[chaim_Avisrur]

Hi everyone , 

we have a problem with some of our linux servers ,
the status is partial Protected ,

• the secure boot is disabled
• the kernel supported
• the policy is the same on all servers (also those with status 'protected')

the only thing that i find is the ited proccess stopped ,

is that can cause the isse?
also cant start the Ited by cmd , while try to start get an error "Incorrect parameter for runtime subcommand"

Any idea will be appreciated

Cortex XDR 

[bbarmanroy]

Hi @chaim_Avisrur Please try the following steps in sequence:

Step 1

You can stop XDR agent and start it with the following commands:

1. cytool runtime stop

2. cytool runtime start

If it fails, try step 2.

Step 2

Check if the problem persists after a reboot

If this fails, try step 3.

Step 3

Create a support ticket and upload the support logs. You can collect support logs by referring to the documentation here. 

[jcandelaria]

Hi @chaim_Avisrur,

Just to verify as well, any of the criteria on this guide are met? even after the runtime stop/start command provided by @bbarmanroy 

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/monitoring/monitor-agent-op...